VVF 3.4 Virus
Virus Name: VVF 3.4
V Status: Rare
Discovered: April, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
Eff Length: 1,614 - 1,628 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, NAVDX, ChAV,
AVTK, IBMAV, VAlert, PCScan,
NShld, Sweep/N, Innoc, AVTK/N, LProt, NAV/N, IBMAV/N
Removal Instructions: Delete infected files
The VVF 3.4 virus was submitted in April, 1992. It is reported to
be from the USSR. VVF 3.4 is a memory resident infector of
.COM and .EXE programs, but not COMMAND.COM.
The first time a program infected with VVF 3.4 is executed, this
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. Total system and available
free memory, as measured by the DOS CHKDSK program, will decrease
by 3,488 bytes. Interrupt 12's return will not have been moved.
Interrupts 1C and 21 will be hooked by VVF 3.4.
Once VVF 3.4 is memory resident, it will infect .COM and .EXE
programs when they are executed. Infected .COM programs will have
a file length increase of 1,614 bytes with the virus being located
at the beginning of the file. Infected .EXE programs will have
a file length increase of 1,614 to 1,628 bytes with the virus
being located at the end of the file. The file's date and time
in the DOS disk directory listing will not be altered. One
text string can be found within the viral code in VVF 3.4 infected
It is unknown what VVF 3.4 does besides replicate.